Issues (299)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/category.php (9 issues)

1
<?php declare(strict_types=1);
2
3
/**
4
 * Module: SmartFAQ
5
 * Author: The SmartFactory <www.smartfactory.ca>
6
 * Licence: GNU
7
 */
8
9
use Xmf\Module\Admin;
10
use Xmf\Request;
11
use XoopsModules\Smartfaq;
12
use XoopsModules\Smartfaq\Category;
13
use XoopsModules\Smartfaq\Helper;
14
15
require_once __DIR__ . '/admin_header.php';
16
17
/** @var Smartfaq\Helper $helper */
18
$helper = Helper::getInstance();
19
20
// Creating the category handler object
21
/** @var \XoopsModules\Smartfaq\CategoryHandler $categoryHandler */
22
$categoryHandler = Helper::getInstance()->getHandler('Category');
23
24
$op = Request::getCmd('op', '');
25
26
// Where do we start?
27
$startcategory = Request::getInt('startcategory', 0, 'GET');
28
29
/**
30
 * @param \XoopsObject|Smartfaq\Category $categoryObj
31
 * @param int                            $level
32
 */
33
function displayCategory($categoryObj, $level = 0): void
34
{
35
    global $xoopsModule, $categoryHandler, $pathIcon16;
36
    $description = $categoryObj->description();
0 ignored issues
show
The method description() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as XoopsGroup or XoopsModules\Smartfaq\Category. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

36
    /** @scrutinizer ignore-call */ 
37
    $description = $categoryObj->description();
Loading history...
37
    if (!XOOPS_USE_MULTIBYTES) {
38
        if (mb_strlen($description) >= 100) {
39
            $description = mb_substr($description, 0, 100 - 1) . '...';
40
        }
41
    }
42
    $modify = "<a href='category.php?op=mod&categoryid=" . $categoryObj->categoryid() . "'><img src='" . $pathIcon16 . '/edit.png' . "' title='" . _AM_SF_EDITCOL . "' alt='" . _AM_SF_EDITCOL . "'></a>";
0 ignored issues
show
The method categoryid() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as XoopsModules\Smartfaq\Faq or XoopsModules\Smartfaq\Category. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

42
    $modify = "<a href='category.php?op=mod&categoryid=" . $categoryObj->/** @scrutinizer ignore-call */ categoryid() . "'><img src='" . $pathIcon16 . '/edit.png' . "' title='" . _AM_SF_EDITCOL . "' alt='" . _AM_SF_EDITCOL . "'></a>";
Loading history...
43
    $delete = "<a href='category.php?op=del&categoryid=" . $categoryObj->categoryid() . "'><img src='" . $pathIcon16 . '/delete.png' . "' title='" . _AM_SF_DELETECOL . "' alt='" . _AM_SF_DELETECOL . "'></a>";
44
45
    $spaces = '';
46
    for ($j = 0; $j < $level; ++$j) {
47
        $spaces .= '&nbsp;&nbsp;&nbsp;';
48
    }
49
50
    echo '<tr>';
51
    echo "<td class='even' align='lefet'>"
52
         . $spaces
53
         . "<a href='"
54
         . XOOPS_URL
55
         . '/modules/'
56
         . $xoopsModule->dirname()
57
         . '/category.php?categoryid='
58
         . $categoryObj->categoryid()
59
         . "'><img src='"
60
         . XOOPS_URL
61
         . "/modules/smartfaq/assets/images/icon/subcat.gif' alt=''>&nbsp;"
62
         . $categoryObj->name()
0 ignored issues
show
The method name() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as XoopsModule or XoopsGroup or XoopsBlock or XoopsModules\Smartfaq\Category or XoopsUser. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

62
         . $categoryObj->/** @scrutinizer ignore-call */ name()
Loading history...
63
         . '</a></td>';
64
    echo "<td class='even' align='left'>" . $description . '</td>';
65
    echo "<td class='even' align='center'>" . $categoryObj->weight() . '</td>';
0 ignored issues
show
The method weight() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as XoopsModule or XoopsBlock or XoopsModules\Smartfaq\Faq or XoopsModules\Smartfaq\Category. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

65
    echo "<td class='even' align='center'>" . $categoryObj->/** @scrutinizer ignore-call */ weight() . '</td>';
Loading history...
66
    echo "<td class='even' align='center'> $modify $delete </td>";
67
    echo '</tr>';
68
    $subCategoriesObj = &$categoryHandler->getCategories(0, 0, $categoryObj->categoryid());
69
    if (count($subCategoriesObj) > 0) {
70
        ++$level;
71
        foreach ($subCategoriesObj as $key => $thiscat) {
72
            displayCategory($thiscat, $level);
73
        }
74
    }
75
    unset($categoryObj);
76
}
77
78
/**
79
 * @param bool $showmenu
80
 * @param int  $categoryid
81
 */
82
function editcat($showmenu = false, $categoryid = 0): void
0 ignored issues
show
The parameter $showmenu is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

82
function editcat(/** @scrutinizer ignore-unused */ $showmenu = false, $categoryid = 0): void

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
83
{
84
    //$moderators = []; // just to define the variable
85
    //$allmods = [];
86
    $startfaq = Request::getInt('startfaq', 0, 'GET');
0 ignored issues
show
The assignment to $startfaq is dead and can be removed.
Loading history...
87
    global $categoryHandler, $xoopsUser, $myts, $xoopsConfig, $xoopsDB, $modify, $xoopsModule, $_GET;
88
    /** @var Smartfaq\Helper $helper */
89
    $helper = Helper::getInstance();
0 ignored issues
show
The assignment to $helper is dead and can be removed.
Loading history...
90
    require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php';
91
92
    // Creating the faq handler object
93
    /** @var \XoopsModules\Smartfaq\FaqHandler $faqHandler */
94
    $faqHandler = Helper::getInstance()->getHandler('Faq');
0 ignored issues
show
The assignment to $faqHandler is dead and can be removed.
Loading history...
95
96
    echo '<script type="text/javascript" src="funcs.js"></script>';
97
    echo '<style>';
98
    echo '<!-- ';
99
    echo 'select { width: 130px; }';
100
    echo '-->';
101
    echo '</style>';
102
    // If there is a parameter, and the id exists, retrieve data: we're editing a category
103
    if (0 != $categoryid) {
104
        // Creating the category object for the selected category
105
        $categoryObj = new Category($categoryid);
106
107
        echo "<br>\n";
108
        if ($categoryObj->notLoaded()) {
109
            redirect_header('category.php', 1, _AM_SF_NOCOLTOEDIT);
110
        }
111
        Smartfaq\Utility::collapsableBar('bottomtable', 'bottomtableicon');
112
        echo "<img id='bottomtableicon' src=" . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . "/assets/images/icon/close12.gif alt=''></a>&nbsp;" . _AM_SF_EDITCOL . '</h3>';
113
        echo "<div id='bottomtable'>";
114
    } else {
115
        $categoryObj = $categoryHandler->create();
116
        echo "<br>\n";
117
        Smartfaq\Utility::collapsableBar('bottomtable', 'bottomtableicon');
118
        echo "<img id='bottomtableicon' src=" . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . "/assets/images/icon/close12.gif alt=''></a>&nbsp;" . _AM_SF_CATEGORY_CREATE . '</h3>';
119
        echo "<div id='bottomtable'>";
120
    }
121
    // Start category form
122
    $sform = new \XoopsThemeForm(_AM_SF_CATEGORY, 'op', xoops_getenv('SCRIPT_NAME'), 'post', true);
123
    $sform->setExtra('enctype="multipart/form-data"');
124
125
    // Name
126
    $sform->addElement(new \XoopsFormText(_AM_SF_CATEGORY, 'name', 50, 255, $categoryObj->name('e')), true);
127
128
    // Parent Category
129
    $mytree = new Smartfaq\Tree($xoopsDB->prefix('smartfaq_categories'), 'categoryid', 'parentid');
130
    ob_start();
131
    $mytree->makeMySelBox('name', 'weight', $categoryObj->parentid(), 1, 'parentid');
132
133
    //makeMySelBox($title,$order="",$preset_id=0, $none=0, $sel_name="", $onchange="")
134
    $sform->addElement(new \XoopsFormLabel(_AM_SF_PARENT_CATEGORY_EXP, ob_get_clean()));
135
136
    /*  $mytree = new Smartfaq\Tree($xoopsDB->prefix("smartfaq_categories"), "categoryid" , "parentid");
137
        ob_start();
138
        $sform->addElement(new \XoopsFormHidden('categoryid', $categoryObj->categoryid()));
139
        $mytree->makeMySelBox("name", "weight", $categoryObj->categoryid());
140
        $sform->addElement(new \XoopsFormLabel(_AM_SF_CATEGORY_FAQ, ob_get_contents()));
141
        ob_end_clean();
142
        */
143
144
    // Decsription
145
    $sform->addElement(new \XoopsFormTextArea(_AM_SF_COLDESCRIPT, 'description', $categoryObj->description('e'), 7, 60));
146
147
    // Weight
148
    $sform->addElement(new \XoopsFormText(_AM_SF_COLPOSIT, 'weight', 4, 4, $categoryObj->weight()));
149
150
    // READ PERMISSIONS
151
    /** @var \XoopsMemberHandler $memberHandler */
152
    $memberHandler = xoops_getHandler('member');
153
    $group_list    = $memberHandler->getGroupList();
154
155
    $groups_read_checkbox = new \XoopsFormCheckBox(_AM_SF_PERMISSIONS_CAT_READ, 'groups_read[]', $categoryObj->getGroups_read());
156
    foreach ($group_list as $group_id => $group_name) {
157
        if (XOOPS_GROUP_ADMIN != $group_id) {
158
            $groups_read_checkbox->addOption($group_id, $group_name);
159
        }
160
    }
161
    $sform->addElement($groups_read_checkbox);
162
    // Apply permissions on all faqs
163
    $addapplyall_radio = new \XoopsFormRadioYN(_AM_SF_PERMISSIONS_APPLY_ON_FAQS, 'applyall', 0, ' ' . _AM_SF_YES, ' ' . _AM_SF_NO);
164
    $sform->addElement($addapplyall_radio);
165
    // MODERATORS
166
    //$moderators_tray = new \XoopsFormElementTray(_AM_SF_MODERATORS_DEF, '');
167
168
    $module_id = $xoopsModule->getVar('mid');
0 ignored issues
show
The assignment to $module_id is dead and can be removed.
Loading history...
169
170
    /** @var \XoopsGroupPermHandler $grouppermHandler */
171
    /*
172
    $grouppermHandler = xoops_getHandler('groupperm');
173
    $mod_perms        = $grouppermHandler->getGroupIds('category_moderation', $categoryid, $module_id);
174
175
    $moderators_select = new \XoopsFormSelect('', 'moderators', $moderators, 5, true);
176
    $moderators_tray->addElement($moderators_select);
177
178
    $butt_mngmods = new \XoopsFormButton('', '', 'Manage mods', 'button');
179
    $butt_mngmods->setExtra('onclick="javascript:small_window(\'pop.php\', 370, 350);"');
180
    $moderators_tray->addElement($butt_mngmods);
181
182
    $butt_delmod = new \XoopsFormButton('', '', 'Delete mod', 'button');
183
    $butt_delmod->setExtra('onclick="javascript:deleteSelectedItemsFromList(this.form.elements[\'moderators[]\']);"');
184
    $moderators_tray->addElement($butt_delmod);
185
186
    $sform->addElement($moderators_tray);
187
    */
188
    $sform->addElement(new \XoopsFormHidden('categoryid', $categoryid));
189
190
    // Action buttons tray
191
    $buttonTray = new \XoopsFormElementTray('', '');
192
193
    /*for ($i = 0, $iMax = count($moderators); $i < $iMax; ++$i) {
194
    $allmods[] = $moderators[$i];
195
    }
196
197
    $hiddenmods = new \XoopsFormHidden('allmods', $allmods);
198
    $buttonTray->addElement($hiddenmods);
199
    */
200
    $hidden = new \XoopsFormHidden('op', 'addcategory');
201
    $buttonTray->addElement($hidden);
202
    // No ID for category -- then it is new category, button says 'Create'
203
    if ($categoryid) {
204
        // button says 'Update'
205
        $butt_create = new \XoopsFormButton('', '', _AM_SF_MODIFY, 'submit');
206
        $butt_create->setExtra('onclick="this.form.elements.op.value=\'addcategory\'"');
207
        $buttonTray->addElement($butt_create);
208
209
        $butt_cancel = new \XoopsFormButton('', '', _AM_SF_CANCEL, 'button');
210
        $butt_cancel->setExtra('onclick="history.go(-1)"');
211
        $buttonTray->addElement($butt_cancel);
212
    } else {
213
        $butt_create = new \XoopsFormButton('', '', _AM_SF_CREATE, 'submit');
214
        $butt_create->setExtra('onclick="this.form.elements.op.value=\'addcategory\'"');
215
        $buttonTray->addElement($butt_create);
216
217
        $butt_clear = new \XoopsFormButton('', '', _AM_SF_CLEAR, 'reset');
218
        $buttonTray->addElement($butt_clear);
219
220
        $butt_cancel = new \XoopsFormButton('', '', _AM_SF_CANCEL, 'button');
221
        $butt_cancel->setExtra('onclick="history.go(-1)"');
222
        $buttonTray->addElement($butt_cancel);
223
    }
224
225
    $sform->addElement($buttonTray);
226
    $sform->display();
227
    echo '</div>';
228
229
    if ($categoryid) {
230
        require_once XOOPS_ROOT_PATH . '/modules/smartfaq/include/displayfaqs.php';
231
    }
232
233
    unset($hidden);
234
}
235
236
switch ($op) {
237
    case 'mod':
238
        $categoryid  = Request::getInt('categoryid', 0, 'GET');
239
        $destList    = Request::getString('destList', '', 'POST');
240
        $adminObject = Admin::getInstance();
241
        xoops_cp_header();
242
243
        $adminObject->displayNavigation(basename(__FILE__));
244
        editcat(true, $categoryid);
245
        break;
246
    case 'addcategory':
247
        global $xoopsUser, $xoopsConfig, $xoopsDB, $xoopsModule, $modify, $myts, $categoryid;
248
249
        $categoryid = Request::getInt('categoryid', 0, 'POST');
250
251
        if (0 != $categoryid) {
252
            $categoryObj = new Category($categoryid);
253
        } else {
254
            $categoryObj = $categoryHandler->create();
255
        }
256
257
        //if (Request::hasVar('allmods', 'POST')) $allmods = $_POST['allmods'];
258
        //if (Request::hasVar('moderators', 'POST')) $moderators = $_POST['moderators'];
259
260
        $categoryObj->setVar('parentid', Request::getInt('parentid', 0, 'POST'));
261
        $applyall = Request::getInt('applyall', 0, 'POST');
262
        $categoryObj->setVar('weight', Request::getInt('weight', 1, 'POST'));
263
264
        // Groups and permissions
265
        if (Request::hasVar('groups_read', 'POST')) {
266
            $categoryObj->setGroups_read($_POST['groups_read']);
267
        } else {
268
            $categoryObj->setGroups_read();
269
        }
270
        //  $groups_admin = isset($_POST['groups_admin'])? $_POST['groups_admin'] : array();
271
        //  $mod_perms = isset($_POST['mod_perms'])? $_POST['mod_perms'] : array();
272
273
        $categoryObj->setVar('name', $_POST['name']);
274
275
        $categoryObj->setVar('description', $_POST['description']);
276
        if ($categoryObj->isNew()) {
277
            $redirect_msg = _AM_SF_CATCREATED;
278
            $redirect_to  = 'category.php?op=mod';
279
        } else {
280
            $redirect_msg = _AM_SF_COLMODIFIED;
281
            $redirect_to  = 'category.php';
282
        }
283
284
        if (!$categoryObj->store()) {
285
            redirect_header('<script>javascript:history.go(-1)</script>', 3, _AM_SF_CATEGORY_SAVE_ERROR . Smartfaq\Utility::formatErrors($categoryObj->getErrors()));
286
        }
287
        // TODO : put this function in the category class
288
        Smartfaq\Utility::saveCategoryPermissions($categoryObj->getGroups_read(), $categoryObj->categoryid(), 'category_read');
289
        //Smartfaq\Utility::saveCategoryPermissions($groups_admin, $categoriesObj->categoryid(), 'category_admin');
290
291
        if ($applyall) {
292
            // TODO : put this function in the category class
293
            Smartfaq\Utility::overrideFaqsPermissions($categoryObj->getGroups_read(), $categoryObj->categoryid());
294
        }
295
296
        redirect_header($redirect_to, 2, $redirect_msg);
297
        break;
298
    case 'del':
299
        global $xoopsUser, $xoopsConfig, $xoopsDB;
300
301
        $module_id = $xoopsModule->getVar('mid');
302
        /** @var \XoopsGroupPermHandler $grouppermHandler */
303
        $grouppermHandler = xoops_getHandler('groupperm');
304
305
        $categoryid = Request::getInt('categoryid', 0, 'POST');
306
        $categoryid = Request::getInt('categoryid', $categoryid, 'GET');
307
308
        $categoryObj = new Category($categoryid);
309
310
        $confirm = Request::getInt('confirm', 0, 'POST');
311
        $name    = Request::getString('name', '', 'POST');
312
313
        if ($confirm) {
314
            if (!$categoryHandler->delete($categoryObj)) {
315
                redirect_header('category.php', 1, _AM_SF_DELETE_CAT_ERROR);
316
            }
317
            redirect_header('category.php', 1, sprintf(_AM_SF_COLISDELETED, $name));
318
        } else {
319
            // no confirm: show deletion condition
320
            $categoryid = Request::getInt('categoryid', 0, 'GET');
321
            xoops_cp_header();
322
            xoops_confirm(
323
                [
324
                    'op'         => 'del',
325
                    'categoryid' => $categoryObj->categoryid(),
326
                    'confirm'    => 1,
327
                    'name'       => $categoryObj->name(),
328
                ],
329
                'category.php',
330
                _AM_SF_DELETECOL . " '" . $categoryObj->name() . "'. <br> <br>" . _AM_SF_DELETE_CAT_CONFIRM,
331
                _AM_SF_DELETE
332
            );
333
            xoops_cp_footer();
334
        }
335
        exit();
336
    case 'cancel':
337
        redirect_header('category.php', 1, sprintf(_AM_SF_BACK2IDX, ''));
338
        break;
339
    case 'default':
340
    default:
341
        $adminObject = Admin::getInstance();
342
        xoops_cp_header();
343
344
        $adminObject->displayNavigation(basename(__FILE__));
345
        echo "<br>\n";
346
347
        // Creating the objects for top categories
348
        $categoriesObj = &$categoryHandler->getCategories($helper->getConfig('perpage'), $startcategory, 0);
349
350
        Smartfaq\Utility::collapsableBar('toptable', 'toptableicon');
351
        echo "<img id='toptableicon' src=" . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . "/assets/images/icon/close12.gif alt=''></a>&nbsp;" . _AM_SF_CATEGORIES_TITLE . '</h3>';
352
        echo "<div id='toptable'>";
353
        echo '<span style="color: #567; margin: 3px 0 12px 0; font-size: small; display: block; ">' . _AM_SF_CATEGORIES_DSC . '</span>';
354
355
        echo "<table width='100%' cellspacing=1 cellpadding=3 border=0 class = outer>";
356
        echo '<tr>';
357
        echo "<th width='35%' class='bg3' align='left'><b>" . _AM_SF_ARTCOLNAME . '</b></td>';
358
        echo "<th class='bg3' align='left'><b>" . _AM_SF_DESCRIP . '</b></td>';
359
        echo "<th class='bg3' width='65' align='center'><b>" . _AM_SF_WEIGHT . '</b></td>';
360
        echo "<th width='60' class='bg3' align='center'><b>" . _AM_SF_ACTION . '</b></td>';
361
        echo '</tr>';
362
        $totalCategories = $categoryHandler->getCategoriesCount(0);
363
        if (count($categoriesObj) > 0) {
364
            foreach ($categoriesObj as $key => $thiscat) {
365
                displayCategory($thiscat);
366
            }
367
        } else {
368
            echo '<tr>';
369
            echo "<td class='head' align='center' colspan= '7'>" . _AM_SF_NOCAT . '</td>';
370
            echo '</tr>';
371
            $categoryid = '0';
372
        }
373
        echo "</table>\n";
374
        require_once XOOPS_ROOT_PATH . '/class/pagenav.php';
375
        $pagenav = new \XoopsPageNav($totalCategories, $helper->getConfig('perpage'), $startcategory, 'startcategory');
376
        echo '<div style="text-align:right;">' . $pagenav->renderNav() . '</div>';
377
        echo '</div>';
378
379
        editcat(false);
380
381
        break;
382
}
383
384
require_once __DIR__ . '/admin_footer.php';
385